Privacy Policy

1. Who is the data controller

The practice is run by a self-employed professional. No data protection officer has been appointed, as none of the circumstances in article 37 of the GDPR applies: you may write directly to the address above.

2. What data is processed and where it comes from

All data comes from you. No lists are bought, no data is obtained from third parties and no profiling is carried out.

• Contact form: name, email address, phone number (optional) and the content of your message.
• Email: whatever data you include in your message.
• Technical connection data: the IP address and basic request data, which the hosting provider records temporarily in order to deliver the page and protect it against attacks. It is not linked to you and is not used to identify you.

This site installs no cookies and uses no analytics tools. The detail is in the Cookie Policy.

3. What it is used for, and on what legal basis

Purpose	Legal basis (art. 6 GDPR)
Answering your enquiry.	Your consent, given when you send the form and tick the corresponding box (art. 6.1.a).
Preparing and sending you a quote at your request.	Pre-contractual steps taken at your request (art. 6.1.b).
Providing the professional service once engaged.	Performance of a contract (art. 6.1.b) and compliance with tax and anti-money-laundering obligations (art. 6.1.c).
Measuring how many people visit the site and which pages they read, and telling whether the Google ads bring real enquiries.	Your consent, given — or withheld — in the cookie notice (art. 6.1.a). Until you give it, nothing is measured.
Delivering the page and protecting it against attacks.	Legitimate interest in the security and operation of the site (art. 6.1.f).

No marketing emails or newsletters are sent. Should they ever be offered, your consent would be requested separately beforehand.

4. How long it is kept

• Enquiries that do not lead to an engagement: for as long as needed to deal with them and, afterwards, no more than one year, in case you come back to the matter.
• Professional relationship: for as long as it lasts and, once ended, for the applicable statutory limitation periods. In tax and accounting matters, six years (art. 30 of the Spanish Commercial Code); for anti-money-laundering purposes, ten years (Law 10/2010).
• Technical connection data: the short period set by the hosting provider, in the order of days.
• Visit measurement data, if you consent to it: fourteen months, which is the maximum the tool allows. The cookies that collect it expire 400 days after your last visit. The detail is in the Cookie Policy.

5. Who it is shared with

Your data is not sold, is not shared for commercial purposes and is not used for advertising.

Only the providers needed for the site and the email to work are involved. They act as data processors under a contract signed in accordance with article 28 of the GDPR:

• Website hosting: Cloudflare, Inc.
• Contact form delivery: the form service provider, which receives the message and forwards it to the practice's mailbox.
• Email: the practice's email provider.
• Visit and advertising measurement: Google Ireland Limited, only if you consent in the cookie notice, through Google Analytics and Google Ads.

Google acts as a data processor for the measurement data under its own data processing terms. For its own advertising purposes Google is an independent controller: that processing is governed by its privacy policy and not by this one. What is collected here with your permission does not include your name, your email address or anything you write in the form.

Your data may also be disclosed to the tax authorities, to the courts or to law enforcement where there is a legal obligation to do so.

6. Transfers outside the European Economic Area

Some of the providers named above are United States companies and may process data outside the European Economic Area. Those transfers rely on the EU–US Data Privacy Framework, where the provider is certified, or on the standard contractual clauses approved by the European Commission, together with any supplementary measures required. You may request a copy of the safeguards applied by writing to the contact address.

7. Your rights

You may exercise the following rights at any time, free of charge:

• Access: to know what data of yours is processed.
• Rectification: to correct anything inaccurate.
• Erasure: to have data deleted once it is no longer needed.
• Restriction: to have data kept but not used while a disagreement is resolved.
• Objection: to object to processing based on legitimate interest.
• Portability: to receive your data in a commonly used format.
• Withdrawing consent at any time, without affecting the lawfulness of processing carried out beforehand.

Simply write to mariacandelariamartin@economistas.org stating which right you wish to exercise. You will receive a reply within one month.

If you believe your data has not been handled properly, you may lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan, 6, 28001 Madrid). Before that, if you prefer, you may write to the contact address above.

8. Security

Technical and organisational measures appropriate to the risk are applied: encrypted communication with the website (HTTPS), restricted access to client information and backups. No system is infallible; should a security breach occur that poses a risk to your rights, you will be notified in accordance with article 34 of the GDPR.

9. Minors

This site is aimed at adults. Data from children under 14 is not knowingly collected. If you become aware that a minor has provided data, please write to the contact address and it will be deleted.

10. Whether you have to provide the data

The fields marked as required in the form are the minimum needed in order to reply to you. If you do not provide them, your enquiry cannot be dealt with. The phone number is optional.

11. Updates

This policy may change when the services used on the site or the applicable legislation change. The version in force is always the one published on this page.

Last updated: September 2026.